CVE-2022-24329 Improper Locking in JetBrains Kotlin
Kotlin Multiplatform Gradle projects cannot lock dependencies, potentially exposing builds to supply chain attacks via dependency substitution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24329?
CVE-2022-24329 is a medium-severity vulnerability in Oracle Communications Cloud Native Core Binding Support Function, published on 25 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
Weakness: CWE-829
Which versions are affected by CVE-2022-24329?
2 open source packages ship an affected version, including org.jetbrains.kotlin:kotlin-stdlib. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
org.jetbrains.kotlin:kotlin-stdlib Maven | All versions | 1.6.0 |
org.jetbrains.kotlin:kotlin-stdlib Maven | All versions | 1.6.0 |
Products include Jetbrains Kotlin, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Pricing Design Center.
How do I fix CVE-2022-24329?
Upgrade org.jetbrains.kotlin:kotlin-stdlib to 1.6.0 or later.
Is CVE-2022-24329 being exploited?
There is no known exploitation of CVE-2022-24329 in the wild and no public exploit code.
Other vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
- CVE-2020-15824 Privilege escalation in n/a
- CVE-2019-10101 Other in n/a
- CVE-2019-10102 Supply chain in n/a
- CVE-2019-10103 Other in n/a
- CVE-2026-53914 JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
All Oracle Communications Cloud Native Core Binding Support Function vulnerabilities
Sources
Also known as GHSA-2qp4-g3q3-f92w, UBUNTU-CVE-2022-24329.